QLogic 8 Gb Intelligent Pass-thru Module for IBM BladeCenter ...

4 – Network and Fabric ConfigurationManaging IP SecuritySIP Security ConceptsIP Security provides encryption-based security for IP version 4 communicationsthrough the use of security policies and associations. The security policy databaseis the set of all security policies configured on the switch. A security policy definesthe following parameters:• Connection source and destination• Data traffic direction: inbound or outbound• Protocols for which to protect data traffic• Security protocols; Authentication Header (AH) or Encapsulating SecurityPayload (ESP)• Level of protection: IP Security, discard, or nonePolicies can define security for host-to-host, host-to-gateway, andgateway-to-gateway connections; one policy for each direction. For example, tosecure the connection between two hosts, you need two policies: one foroutbound traffic from the source to the destination, and another for inbound trafficto the source from the destination. You can specify sources and destinations by IPaddresses or DNS host names. If a host name resolves to more than one IPaddress, the switch creates the necessary policies and associations. You canrecognize these dynamic policies and associations because their names beginwith DynamicSP_ and DynamicSA_ respectively.You can apply IP security to all communication between two systems, or to selectprotocols, such as ICMP, TCP, or UDP. Furthermore, instead of applying IPsecurity, you can choose to discard all inbound or outbound traffic, or allow alltraffic without encryption. Both the AH and ESP security protocols provide sourceauthentication, ensure data integrity, and protect against replay.A security association defines the encryption algorithm and encryption key toapply when called by a security policy. A security policy may call severalassociations at different times, but each association is related to only one policy.The security association database is the set of all security associations.IP Security configurations can be complex: it is possible to unintentionallyconfigure policies and associations that isolate a switch from all communication. Ifthis happens, you can disable IP Security by placing the switch in maintenancemode, and correct the problem through the serial port interface. Refer to theQLogic 8 Gb Intelligent Pass-thru Module and 20-Port 8 Gb SAN Switch Modules:Installation Guide for information about using maintenance mode and connectingthrough the serial port.4-6 59245-01 A